1. ABOUT THIS NOTICE

We ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal data, your rights in relation to your personal data and on how to contact us and supervisory authorities in the event that you have a query or complaint.

The University of Warwick (“UoW”) is committed to protecting the privacy and security of personal data. The purpose of this notice is to promote transparency in the use of personal data, and to outline how UoW collects and uses your personal data, in accordance with the General Data Protection Regulation 2016 (“GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

The UoW collects, uses and is responsible for certain personal data about you. This is known as “processing”. When we do so we are regulated under the GDPR and DPA 2018 which applies across the European Union and we are responsible as ‘data controller’ of those personal data for the purposes of those laws.

The purpose of this notice is to explain how the UoW and more specifically the Warwick Clinical Trials Unit (“WCTU”) will collect and use (process) your personal data, what rights you have in relation to those data and to provide transparency about the data collected about you.

The UoW is the data controller under the GDPR and the DPA 2018 and we will process your personal data in accordance with the GDPR and DPA 2018 at all times. You, as a ‘data subject’, therefore have specific rights to the data that we hold, collect and process.

Throughout this notice, “University”, “we”, “our”, and “us” refer to the UoW and WCTU; “you” and “your” refer to any of the following:

• Patient and Public Involvement (PPI) representatives
• Data Monitoring Committee (DMC) and Trial Steering Committee (TSC) Members
• Staff performing clinical trial activities at nominated investigator sites
• Clinical and Lay Research Facilitators
• Clinical Trial collaborators and Trial Management Personnel

If you would like this notice in another format (for example: audio, large print, braille), please contact us using the details at the bottom of this notice.

2. THE PERSONAL DATA WE COLLECT AND USE

Personal data:

The following are examples of personal data which may be collected, stored and used by WCTU about you:

• Personal identifiers: Full name;
• Contact details: Home address, telephone number, email address;
• Professional details: your place of work, job title, professional qualifications, training and experience;
• Dates of WCTU meetings you attend (in person, or via telephone/video conference, and any notes made;

Special Category Data:

Special Category personal data is any identifying information including but not limited to the following: racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning health or data concerning a natural person’s sex life or sexual orientation. Some data collected and processed for the purposes of providing you with support may constitute special category data.

3. HOW THE WCTU OBTAINS YOUR PERSONAL DATA

WCTU may collect and hold your personal data in a number of ways, for example:

• From information provided to us by yourself when contacting WCTU;
• Through communication from you (for example by telephone, email, letter, or via the website). For example, when you call to make enquiries about WCTU or when you are raising concerns.
• We may also gain your personal data from third parties, for example, from your employer or any other concerned third parties.

4. PURPOSE AND ASSOCIATED LAWFUL BASIS

Examples of ways WCTU will process your personal data for the following reasons include but are not limited to:

Purpose	Lawful Basis
Managing our relationship with you, including planning, organising and reviewing research we perform with you	Task in the public interest
To comply with requirements of the Medicines for Human Use (Clinical Trial) Regulations and the principles of Good Clinical Practice (GCP) in relation to ensuring appropriate delegation and training of individuals conducting key trial activities and to coordinate oversight of the safety and integrity of the trial and its participants through pharmacovigilance and oversight and management committees	Legal Obligation
Review and approval of the research by the Health Research Authority, ethics committees or applicable regulatory authorities	Task in the public interest
Publication of trial results	Task in the public interest
To get in touch with you about new collaboration opportunities	Legitimate interest

Where any of the above activities involve any special category data WCTU will only process these data if your explicit consent has been obtained, is necessary to protect the vital interests, or is necessary for reasons of substantial public interest.

5. SPECIAL CATEGORY DATA

We may only process special category personal data in the following circumstances where, in addition to a lawful basis for processing, there exists one of the following grounds:

• Explicit consent – where you have given us explicit consent.
• Legal obligation related to employment - The processing is necessary for a legal obligation in the field of employment and social security law or for a collective agreement.
• Vital interests - The processing is necessary in order to protect the vital interests of the individual or of another natural person where the data subject is physically or legally incapable of giving consent. This is typically limited to processing needed for medical emergencies.
• Not for profit bodies - The processing is carried out in the course of the legitimate activities of a not-for-profit body and only relates to members or related persons and the personal data is not disclosed outside that body without consent.
• Public information - The processing relates to personal data which are manifestly made public by the data subject.
• Legal claims - The processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
• Substantial public interest - The processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law.
• Healthcare - The processing is necessary for healthcare purposes and is subject to suitable safeguards.
• Public health - The processing is necessary for public health purposes and is based on Union or Member State law.
• Archive - The processing is necessary for archiving, scientific or historical research purposes, or statistical purposes and is based on Union or Member State law. Member States can introduce additional conditions in relation to health, genetic, or biometric data.

WCTU will only use personal data for the purpose(s) for they were collected unless it is considered reasonable that they are needed for another purpose and the reason is compatible with the original purpose. If WCTU needs to use your personal data for an unrelated purpose, it will notify you and will explain the legal basis that permits it to do so. WCTU may process your personal data without your knowledge or consent, in compliance with this policy and procedure, where this is permitted by law.

6. CONFIDENTIALITY AND DATA SHARING

WCTU is committed to providing a confidential service and all WCTU practitioners work to recognised standards of confidentiality from professional bodies.

Different areas of WCTU may share your personal data, in order to provide you with the best quality of service and support, with third parties where required by law, where it is necessary to administer the working relationship with you or where there is another legitimate interest in doing so. Third parties with whom WCTU may share your data include:

Third parties within the EEA	Lawful basis
Regulatory authorities for the purpose of approval of the research and GCP inspections	Legal obligation
HRA, ethics committees and the relevant funding bodies in order to seek continuing approval and oversight of the research	Task in the public interest

Transfers of data outside of the EEA

Your personal data may be transferred outside of the EEA. Where any sharing or transfer of data occurs outside of the EEA, we will ensure that there are appropriate safeguards in place to protect your personal data. Your personal data will be retained for as long as we continue to collaborate with you on research related matters, unless a longer retention period is required or permitted by clinical trial related laws and regulations. If this is the case, the minimum retention period will be detailed in the clinical trial protocol.

7. RETENTION OF YOUR PERSONAL DATA

The GDPR and DPA 2018 requires that personal data should be kept for no longer than is necessary for the purposes for which the personal data are processed (except in certain specific and limited instances).

The University’s Record Retention Schedule (RRS) is a tool that enables UoW to transparently demonstrate how the organisation complies with its data protection obligations by making provision for the time periods for which common classes of record are retained by UoW.

Full details of the retention periods of records can be found by viewing the records management page and selecting UoW’s Record Retention Schedule (RRS), which is kept up to date separately.

8. DATA SUBJECT RIGHTS

Under the GDPR and DPA 2018 you have a number of important rights free of charge.

You have the right to:

• Be informed of how we collect and use your personal data;
• Access your personal data;
• Require us to correct any mistakes in the data we hold on you;
• Require the erasure of personal data concerning you in certain situations;
• Restrict our processing of your personal data in certain circumstances;
• Receive your personal data, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
• Object in certain situations to our continued processing of your personal data or at any time to processing of your personal data for direct marketing; and
• Object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.

To exercise any of these rights please find out more here. If a subject access request is made and the request for access is clearly unfounded or excessive, UoW reserves the right to refuse to comply with the request in these circumstances.

9. KEEPING YOUR PERSONAL DATA SECURE

WCTU keeps your personal data secure at all times using both physical and technical measures.

Where appropriate, we also take measures such as anonymisation to ensure data cannot be used to identify you and/or encryption to ensure that the data cannot be accessed without the right security permissions and codes.

Where WCTU engages a third party to process personal data it will do so on the basis of a written contract which conforms to the security requirement of the GDPR and DPA 2018.

WCTU takes measures to enable data to be restored and accessed in a timely manner in the event of a physical or technical incident.

WCTU also ensures that appropriate processes are in place to test the effectiveness of our security measures.

10. HOW TO CONTACT US

We hope that our Data Protection Officer (DPO) can resolve any query, concern or complaint you raise about our use of your personal data on the contact details below:

infocompliance@warwick.ac.uk

Or write to:

The Data Protection Officer

Legal & Compliance Services
University of Warwick
University House
Kirby Corner Road
CV4 8UW

The GDPR and DPA 2018 also give you the right to lodge a complaint with the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone: [0303 123 1113].

11. CHANGES TO THIS PRIVACY NOTICE

This privacy notice was published on 16 July 2020 and last updated on 22 Mar 2023.

We will review and may change this privacy notice from time to time, when we do we will inform you by putting a message on the website and/or e-mail.